https://pwn.watch/t/qualcomm Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 03 Jun 2025 00:00:00 GMT https://pwn.watch/i/qualcomm-multiple-chipsets-cve-2025-21479 https://pwn.watch/i/qualcomm-multiple-chipsets-cve-2025-21479 Tue, 03 Jun 2025 00:00:00 GMT high <p>CVE-2025-21479: Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. CVE-2025-21480: Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands. CVE-2025-27038: Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome. Added to CISA KEV on 2025-06-03.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-06-03: CISA added CVE-2025-21479 to the KEV catalog (due 2025-06-24).</li><li>2025-06-03: CISA added CVE-2025-21480 to the KEV catalog (due 2025-06-24).</li><li>2025-06-03: CISA added CVE-2025-27038 to the KEV catalog (due 2025-06-24).</li></ul> <p><strong>CVEs:</strong> CVE-2025-21479, CVE-2025-21480, CVE-2025-27038</p> https://pwn.watch/i/qualcomm-multiple-chipsets-cve-2024-43047 https://pwn.watch/i/qualcomm-multiple-chipsets-cve-2024-43047 Tue, 08 Oct 2024 00:00:00 GMT high <p>Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. Added to the CISA KEV catalog on 2024-10-08.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-08: CISA added CVE-2024-43047 to the KEV catalog (federal deadline 2024-10-29) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-10-07: CVE-2024-43047 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-43047">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-43047</p> https://pwn.watch/i/qualcomm-multiple-chipsets-cve-2022-22071-and-3-more https://pwn.watch/i/qualcomm-multiple-chipsets-cve-2022-22071-and-3-more Tue, 05 Dec 2023 00:00:00 GMT high <p>Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress. Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP. Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. Added to CISA KEV on 2023-12-05.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-12-05: CISA added CVE-2022-22071 to the KEV catalog (due 2023-12-26).</li><li>2023-12-05: CISA added CVE-2023-33063 to the KEV catalog (due 2023-12-26).</li><li>2023-12-05: CISA added CVE-2023-33106 to the KEV catalog (due 2023-12-26).</li></ul> <p><strong>CVEs:</strong> CVE-2022-22071, CVE-2023-33063, CVE-2023-33106, CVE-2023-33107</p>